CVE-2020-14297 — Wildfly EJB Client causes DoS

Description

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

Affected products

Vendor	Product	Affected	Fixed
Red Hat	wildfly	jboss-ejb-client as shipped with Red Hat JBoss EAP 7	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.2.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-13.SP3_redhat_00011.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hal-console	3.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.17-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.33-2.SP1_redhat_00001.1.el6eap	RHSA-2020:3142, RHSA-2020:3141
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-7.SP2_redhat_00005.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-13.Final_redhat_00014.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-7.Final_redhat_00009.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-4.SP3_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-netty +1	4.1.48-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-10.SP9_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-4.SP4_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-4.Final_redhat_00004.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.8-6.GA_redhat_00003.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.2-1.Final_redhat_00002.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.21-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.8-6.GA_redhat_00003.1.el7eap	RHSA-2020:3638, RHSA-2020:3462, RHSA-2020:3142
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.13-1.Final_redhat_00001.1.el6eap	RHSA-2020:3142, RHSA-2020:3141
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.11-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat A Mq Clients 2	nodejs-rhea	1.0.24-1.el8	RHSA-2020:3817
Red Hat A Mq Clients 2	python3-qpid-proton	0.32.0-2.el8	RHSA-2020:3817
Red Hat A Mq Clients 2	qpid-cpp +3	1.36.0-31.el6_10amq	RHSA-2020:3817
Red Hat A Mq Clients 2	qpid-proton +9	0.32.0-1.el6_10	RHSA-2020:3817
Red Hat A Mq Clients 2	rubygem-qpid_proton	0.32.0-2.el7	RHSA-2020:3817

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jboss:jboss-ejb-client	< 4.0.34.Final	4.0.34.Final	GHSA-qcch-9268-59jw

Advisories 11

RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3817 Red Hat Security Advisory: AMQ Clients 2.8.0 Release Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:3141 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:3142 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297

CNA	v3.1	6.5
EUVD	v3.1	6.5
OSV:GHSA	v3.1	6.5